139676 - does not open file location in a href=file

Status: VERIFIED INVALID

(Core :: Networking: File, defect)

Description

[Nikolaus Hiebaum]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.0rc1) Gecko/20020417
BuildID:    2002041711

If "file" is used instead of "http" in the a href tag, Mozilla does not open the
specified html-file (IE and NS do).

Reproducible: Always
Steps to Reproduce:
1.html-file with a href tag pointing to file://j:/somewhere/xx.html
2.reload page
3.click on the link - nothing happens

Comment 1

[Rainer Bielefeld]

WFM with Mozilla/5.0 (Windows; U; Win98; de-AT; rv:1.0rc1) Gecko/20020417.

Reporter, can you create 2 short test-files as att.:
- Filewithnotworkinglink.html
- Filewherelinkedto.html

Comment 2

[Karl Johan Kleist]

The given example "file://j:/somewhere/xx.html" is incorrect in two ways:

1. There should be three slashes after "file:" (see RFC 1738)

2. There should be a vertical bar after the drive letter (don't know where
   this is specified)

Hence: "file:///j|/somewhere/xx.html" should, and does, work.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Is the link to a file:// url in a web page or in a local file?  Because web
pages cannot link to local files for security reasons.

Comment 4

[JWBohrer]

"Because web pages cannot link to local files for security reasons."

Do you mean Mozilla cannont perform those links? Because other browsers can. If
it is just Mozilla, perhaps there should be pref for this. I tried, months ago,
to make a sidebar panel that would link to the harddrive, so one could play
locally stored music or movies in the sidebar. This feature or bug precludes that.

Comment 5

[Boris Zbarsky [:bzbarsky]]

> Do you mean Mozilla cannont perform those links?

It can, but does not by default.

> perhaps there should be pref for this.

There is:

user_pref("security.checkloaduri", false);

Keep in mind that this opens you up to all sorts of cute security attacks.

> I tried, months ago, to make a sidebar panel that would link to the harddrive

You could just make it a chrome sidebar... That means the user has to actually
approve its installation, but it gets installed locally and has the same
permissions as the rest of the browser UI (this includes the permission to load
local files regardless of the value of the checkloaduri pref).

Comment 6

[Kai Lahmann (is there, where MNG is)]

INVALID as the URL misses a /

Comment 7

[benc]

VERIFIED: (RC1 review)
there should be what I've labled "drive promotion", where the extra slash is added.
It might not work in links, but would work in location/URL.

I'll look at that and update the documentation and testcases.

Comment 8

[Andrew DeFaria]

Security is not insured at all because all the user need to is copy the link
location and paste it into the address bar in order to "go to" the link.

Comment 9

[Boris Zbarsky [:bzbarsky]]

Yeah, if the user does that, they can get screwed.  They can get screwed in lots
of other ways by doing things too.  The idea is to prevent an onload handler
setting document.location to that url, for instance...